Skip to main content
student1363
student1363
New Member
December 13, 2017
Solved

can fortigate do these

  • December 13, 2017
  • 1 reply
  • 4814 views

hi,

I am going to buy a fortigate 100 series (not decided specifically on model). What I really need to know is whether it support "reverse proxy" or not. I want it between internet and my webserver (I know about the foriweb, but I am tight in budget and want other fortigate features like IPS as well).

Another question is, does fortigate need any license for HA?

my last question is, can fortigate get authentication info from users ( for services that need it like email or sharepoint) and give it to server; if authentication was successful user will be directed to server.

 

thanks in advance

    Best answer by aagrafi

    To create a user based policy, first you create users/user groups (User & Device > User Definition/User Groups). Then you go to the desired policy and select source (Policy & Objects > IPv4 Policy > Source). There FG allows you to enter source address objects and user objects. Selecting user you can input the users/user groups you created before.

     

    You can also use LDAP for user authentication.

     

    The above example is from 5.4. In other FortiOS versions the procedure might be slightly different.

    1 reply

    aagrafi
    aagrafi
    New Member
    December 13, 2017

    Yes, reverse proxy WAF functionality is supported in the FG. You'll need to purchase the WAF FortiGuard license at least. Also have in mind that WAF in the FG is strictly signature based.

     

    HA does not need any special license, BUT all FGs in the cluster must have exactly the same FortiGuard licenses. Even if the cluster is active-standby, you need FortiGuard licenses for both FGs.

     

    I don't quite understand the last question, but I think the functionality you are looking for looks like user based firewall policies. If so, then yes, this is supported. Please clarify.

    student1363
    student1363Author
    New Member
    December 16, 2017

    aagrafi wrote:

     

    I don't quite understand the last question, but I think the functionality you are looking for looks like user based firewall policies. If so, then yes, this is supported. Please clarify.

    Thanks aagrafi 

    Yes, you understood right. I want policies base on username. but I can't find where in IPv4 policy can I add user/group? I can't add it as source.

     

    In addition, how the FG gets authentication info from users?

     

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    December 16, 2017

    Identity based policies are configured differently in the various FortiOS versions. Tell us yours and we can be more specific. Or you can find the relevant information in the FortiOS Handbook.

     

    Auth is bound to fgt, telnet or http as the user has to interact with the FGT.

    A different way is to use FSSO (single sign on), using a client listening on a DC which relays the user's login status to the FGT.

    Terms & ConditionsAccessibility statement